Imagine you run a secure webmail provider where all data is truly encrypted and served up to the user that decrypts it using a 3rd party javascript library that

Imagine you run a secure webmail provider where all data is truly encrypted and served up to the user that decrypts it using a 3rd party javascript library that isn't even hosted on your site. Based on the wording of this they could compel you to target that user and serve up a javascript decryption library of the governments choice. In a similar vein they could compel Android/MS/IOS system updates to include trojans in search of decryption keys. Edit: This is a good argument to only use Linux or BSD. Unless you had some sort of management contract it would be near impossible to be directly targeted with system updates. They'd have to get the signing key for your distro and intercept/rewrite package downloads. I bet you this is standard affair for high value targets. If you were paranoid you could update or mirror through a proxy.